Reach your apps. Nothing else. Quantum-safe.
Prismara ZTNA connects each person to exactly the applications they are allowed to use, checked on every flow, instead of opening your whole network like a VPN. Access comes as short-lived signed bundles over post-quantum tunnels, so traffic recorded today stays private tomorrow. Only licensed users in active tenants get in, and when someone leaves, their access is gone within seconds.
What Prismara ZTNA does
Default deny on every flow
The agent and the gateway both check every flow against policy. The local network cannot open connections to your devices.
Short-lived, signed access
Each device receives a short-lived access bundle signed by the controller, so permissions expire on their own instead of lingering.
Quantum-safe tunnels
WireGuard tunnels use a pre-shared key from an ML-KEM-768 exchange, rotated on a schedule, and reach around 2 Gbit/s each way on a single stream.
Licences enforced at the door
Prismara Admin licences are checked at every sign-in and every bundle. If Admin is unreachable, existing access continues for up to 15 minutes and then ends.
Post-quantum sign-in
Post-quantum ID tokens from Prismara Identity are verified natively, with an option to accept only a post-quantum issuer.
Leavers lose access in seconds
Disable or delete a user in Prismara Identity or Entra ID and SCIM revokes their access within seconds.
Only healthy devices get in
Disk encryption, firewall, Secure Boot, OS version and agent version are checked before access is granted.
Built to stay up
Run one controller or several replicas on PostgreSQL, managed from a web console or admin CLI with licences, the audit chain and the Prismara app launcher in one place.
How it's secured
Prismara ZTNA follows the engineering rules shared across the suite, plus these product-specific measures.
Post-quantum control plane
TLS 1.3 with hybrid X25519MLKEM768, and every message signed with both Ed25519 and ML-DSA-65.
Fails closed
Routes, firewall rules, licence checks and access all fail closed, with an nftables backstop on Linux.
Safe key rotation
Controller keys rotate only once every active gateway and device trusts the new key, including across high-availability replicas.
Connects to the rest of the suite
Want SovSec to run it for you?
SovSec provides managed security, SOC and Microsoft 365 services for organisations in the UK and DACH region, and can run Prismara as part of that service.